Keep your API keys away from AI coding agents

AI coding agents run real commands — pushing to GitHub, calling APIs, deploying — and those commands need secrets. The usual answer is to drop keys into a .env file or export them in the shell. But then the agent, its logs, its terminal scrollback, and its context window can all read the raw value, and a single leaked or malicious command can exfiltrate it. Leaked-secret volume is climbing fast as more coding is agent-assisted.

The agent receives the command's result — a successful push, an API response — but the plaintext key never appears in a prompt, a log, the chat history, or the agent's own process environment. You can require a Touch ID approval on every use, or grant a short standing window. Secrets never sync to the cloud in the clear; if you forward one to another of your own devices, it travels end-to-end encrypted.

How it works

1. 1Store the secret once in Vault — it's written to the macOS Keychain, never to UserDefaults, a JSON file, or a log.
2. 2Grant it to a specific Thread so only the agents in that workspace can use it (deny-by-default everywhere else).
3. 3The agent runs its command through the broker (for example: forkbench-secret exec GITHUB_TOKEN -- git push). The key is injected into that one child process.
4. 4Optionally require Touch ID for every use, so no command runs with a secret without your fingerprint.

Straight about the guarantee: This is an op-run / ssh-agent-grade guarantee: no accidental exposure during normal use. Like every broker of this kind, an agent you deliberately hand a secret to for a command could still choose to print it — the value stays out of prompts, logs, and the agent's environment, but the guarantee is about accidental exposure, not defeating an actively hostile command.